MAL-2026-4741

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/aurafarmer/MAL-2026-4741.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4741
Published
2026-05-19T21:52:37Z
Modified
2026-05-26T06:03:09Z
Summary
Malicious code in aurafarmer (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (967bdc07ba43b92a320ad0ef81975a5547d24b987eda5b8cdf863fc7c18245e0)

The package advertises an aurex CLI. Its login flow (aurex/main.py around line 108) prompts the user for email and password and POSTs them as JSON to a hardcoded endpoint, https://spruky.qzz.io/aurafarmer/endpoint, defined in aurex/config.py line 5. The destination is a free dynamic-DNS host (qzz.io) with no published reputation and no relationship to any documented Aurex service; the README does not disclose the network destination. Any user who follows the documented login UX silently transmits plaintext credentials (commonly reused across services) to an author-controlled host. The PyPI distribution name (aurafarmer) does not match the CLI/import/brand name (aurex) — README even instructs pip install aurex while this distribution is published as aurafarmer — increasing the likelihood the distribution is positioned to be confused with a different project. Caller-supplied secrets flowing to a hardcoded, undisclosed, author-controlled endpoint is the silent-relay shape.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-003288",
            "import_time":  "2026-05-26T05:50:21.401583408Z",
            "modified_time":  "2026-05-19T21:52:37Z",
            "sha256":  "967bdc07ba43b92a320ad0ef81975a5547d24b987eda5b8cdf863fc7c18245e0",
            "source":  "amazon-inspector",
            "versions":  [
                "0.3.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / aurafarmer

Package

Name
aurafarmer
View open source insights on deps.dev
Purl
pkg:pypi/aurafarmer

Affected ranges

Affected versions

0.*
0.3.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "aurex/main.py",
            "sha256":  "7924d3d9f9e8d16b634ba95c63457256726a7e6c2d363ce280ba0dfb172eff5d",
            "tlsh":  "3432f375a47d2c32f353cc5cae96c01006a679833944787879acb1989fdc932b6b2b79"
        },
        {
            "path":  "pyproject.toml",
            "sha256":  "9debe39c1783e159cc2f5c1bf994882900abd5e75f2abf157c43daa0f54de61a",
            "tlsh":  "25f00226cd365e23cad5605c2460c9827e71752632d0a00d70cec15c5e9d0c1d3ede3c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "aurafarmer-0.3.0-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "1d2328967721027fd95c6aa9085716f0e3c9b5af0011e876c92e9f0f2158073f",
                "md5":  "cef0618a974e9c7b5551f5fe6a13b890",
                "sha256":  "8ee81c988b9bf1ada08b28a11d86f4cab9e5c5c36f7c75fa7161f442f2bc9027"
            }
        },
        {
            "filename":  "aurafarmer-0.3.0.tar.gz",
            "hashes":  {
                "blake2b_256":  "2b83be64af7fa0721ee24d2ef23d9c63fb8c2d1efb124ddbbe0d664b200b8124",
                "md5":  "5ab81b03d0e9e0203b08eb3ffd10cbc8",
                "sha256":  "239a3399065ad563f302257deaa5f996eb3499bd92dc439dbc5a282a86724473"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/aurafarmer/MAL-2026-4741.json"